Reserved top-level keywords

Keys such as stages, variables, include, workflow, default, image, services, cache, and before_script are pipeline keywords. Any other top-level key is parsed as a job name.

extends merge behavior

extends performs a reverse deep merge: the child overrides scalar values, arrays are replaced not concatenated, and up to eleven inheritance levels are permitted.

A YAML tag that copies a specific key, including nested keys, from another job or from a hidden template job, avoiding duplication without full inheritance.

workflow rules purpose

Global workflow:rules decide whether the pipeline is created at all, unlike job rules which only decide whether an individual job is added.

after_script isolation

after_script runs in a separate shell after the job, so exported variables, working directory changes, and shell state from script do not carry over.

default keyword scope

default sets image, services, cache, before_script, after_script, tags, and retry for all jobs; a job-level value replaces rather than merges with the default.

include supports local files, remote URLs, CI templates, and other projects; project includes require include:file and optionally include:ref to pin a branch or tag.

Runner config.toml concurrent

The top-level concurrent value caps how many jobs one runner process executes simultaneously across all [[runners]] entries defined in that configuration file.

Runner authentication token

A token created in the UI or API that identifies a runner in config.toml. It replaces the deprecated registration token flow and is not a user credential.

A job runs only on a runner that has every tag listed on the job. No matching runner leaves the job pending with a no-runners error.

Protected runner behavior

Protected runners accept only jobs running on protected branches or protected tags, which prevents unprotected feature branches from reaching production infrastructure and secrets.

Shell executor limitation

The shell executor ignores image and services and runs commands directly on the runner host, inheriting its installed software, environment, and permissions.

Docker executor isolation

The docker executor runs each job in a fresh container from the job image, with the repository cloned into the build directory and services on a linked network.

Kubernetes executor model

The kubernetes executor creates a pod per job, with the build container plus service containers, and supports autoscaling and ephemeral runner environments.

Variable precedence order

Highest to lowest: trigger and manual pipeline variables, project, group, instance, job-level YAML, global YAML, then deployment variables. Higher entries override lower ones.

Protected variable rule

A protected variable is injected only into pipelines running on protected branches or protected tags, keeping production secrets away from feature branches and forks.

Masked variable constraints

Masked values must be at least eight characters, contain no whitespace, and use a Base64 or hex-safe character set; masking redacts logs but does not encrypt storage.

A file variable writes its value to a temporary file and sets the variable to that file path, used for kubeconfig, certificates, and SSH private keys.

id_tokens issues a signed JWT with a configured audience, letting jobs authenticate to cloud providers without storing long-lived static credentials in variables.

Cache versus artifacts

Cache is best-effort storage on the runner for speeding repeat jobs; artifacts are uploaded to GitLab and guaranteed to be available to later-stage jobs.

cache:key:files computes a SHA over listed lockfiles, so changing dependencies produces a new cache key and avoids restoring stale packages.

expire_in sets how long artifacts are retained before deletion, such as one week or thirty days, controlling storage use for build outputs and reports.

dependencies lists which earlier jobs' artifacts a job downloads. Omitting it downloads artifacts from all jobs in previous stages, which can slow pipelines.

parallel:matrix expands named dimensions into one job per combination, each receiving the dimension values as variables, enabling cross-version test grids.

Setting needs to an empty array makes a job start immediately without waiting for any stage, useful for fast lint or config checks.

rules first match wins

rules are evaluated in order and the first matching rule sets the job's attributes; a matching rule with when: never excludes the job.

rules:changes compares against the previous commit on branches and the target branch on merge requests, and always evaluates true on new branches and schedules.

when: delayed postpones a job by a start_in duration such as thirty minutes, often used to stage a timed deployment after a manual gate.

Trigger strategy depend

With strategy: depend, the parent trigger job mirrors the downstream pipeline's status instead of succeeding as soon as the downstream pipeline is created.

A trigger job with include starts a child pipeline from a generated or static YAML file; it appears nested in the parent pipeline graph.

Protected environment

A protected environment restricts deployments to permitted roles and branches, and jobs deploying to it can access protected variables and require approvals.

The /ci/lint page and the projects/:id/ci/lint API validate pipeline YAML, catching syntax errors, duplicate keys, and unresolvable references before merging.

GitLab CI/CD Specialist study materials

GitLab CI/CD Specialist flashcards

GitLab CI/CD Specialist · Build recall with a focused review session.

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Reserved top-level keywords: Keys such as stages, variables, include, workflow, default, image, services, cache, and before_script are pipeline keywords. Any other top-level key is parsed as a job name.
extends merge behavior: extends performs a reverse deep merge: the child overrides scalar values, arrays are replaced not concatenated, and up to eleven inheritance levels are permitted.
!reference tag: A YAML tag that copies a specific key, including nested keys, from another job or from a hidden template job, avoiding duplication without full inheritance.
workflow rules purpose: Global workflow:rules decide whether the pipeline is created at all, unlike job rules which only decide whether an individual job is added.
after_script isolation: after_script runs in a separate shell after the job, so exported variables, working directory changes, and shell state from script do not carry over.
default keyword scope: default sets image, services, cache, before_script, after_script, tags, and retry for all jobs; a job-level value replaces rather than merges with the default.
Include source types: include supports local files, remote URLs, CI templates, and other projects; project includes require include:file and optionally include:ref to pin a branch or tag.
Runner config.toml concurrent: The top-level concurrent value caps how many jobs one runner process executes simultaneously across all [[runners]] entries defined in that configuration file.
Runner authentication token: A token created in the UI or API that identifies a runner in config.toml. It replaces the deprecated registration token flow and is not a user credential.
Job tag matching: A job runs only on a runner that has every tag listed on the job. No matching runner leaves the job pending with a no-runners error.
Protected runner behavior: Protected runners accept only jobs running on protected branches or protected tags, which prevents unprotected feature branches from reaching production infrastructure and secrets.
Shell executor limitation: The shell executor ignores image and services and runs commands directly on the runner host, inheriting its installed software, environment, and permissions.
Docker executor isolation: The docker executor runs each job in a fresh container from the job image, with the repository cloned into the build directory and services on a linked network.
Kubernetes executor model: The kubernetes executor creates a pod per job, with the build container plus service containers, and supports autoscaling and ephemeral runner environments.
Variable precedence order: Highest to lowest: trigger and manual pipeline variables, project, group, instance, job-level YAML, global YAML, then deployment variables. Higher entries override lower ones.
Protected variable rule: A protected variable is injected only into pipelines running on protected branches or protected tags, keeping production secrets away from feature branches and forks.
Masked variable constraints: Masked values must be at least eight characters, contain no whitespace, and use a Base64 or hex-safe character set; masking redacts logs but does not encrypt storage.
File-type variable: A file variable writes its value to a temporary file and sets the variable to that file path, used for kubeconfig, certificates, and SSH private keys.
id_tokens OIDC: id_tokens issues a signed JWT with a configured audience, letting jobs authenticate to cloud providers without storing long-lived static credentials in variables.
Cache versus artifacts: Cache is best-effort storage on the runner for speeding repeat jobs; artifacts are uploaded to GitLab and guaranteed to be available to later-stage jobs.
cache key files: cache:key:files computes a SHA over listed lockfiles, so changing dependencies produces a new cache key and avoids restoring stale packages.
Artifact expire_in: expire_in sets how long artifacts are retained before deletion, such as one week or thirty days, controlling storage use for build outputs and reports.
dependencies keyword: dependencies lists which earlier jobs' artifacts a job downloads. Omitting it downloads artifacts from all jobs in previous stages, which can slow pipelines.
parallel matrix: parallel:matrix expands named dimensions into one job per combination, each receiving the dimension values as variables, enabling cross-version test grids.
needs empty array: Setting needs to an empty array makes a job start immediately without waiting for any stage, useful for fast lint or config checks.
rules first match wins: rules are evaluated in order and the first matching rule sets the job's attributes; a matching rule with when: never excludes the job.
rules changes caveat: rules:changes compares against the previous commit on branches and the target branch on merge requests, and always evaluates true on new branches and schedules.
when delayed: when: delayed postpones a job by a start_in duration such as thirty minutes, often used to stage a timed deployment after a manual gate.
Trigger strategy depend: With strategy: depend, the parent trigger job mirrors the downstream pipeline's status instead of succeeding as soon as the downstream pipeline is created.
Child pipeline: A trigger job with include starts a child pipeline from a generated or static YAML file; it appears nested in the parent pipeline graph.
Protected environment: A protected environment restricts deployments to permitted roles and branches, and jobs deploying to it can access protected variables and require approvals.
CI Lint endpoint: The /ci/lint page and the projects/:id/ci/lint API validate pipeline YAML, catching syntax errors, duplicate keys, and unresolvable references before merging.